We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk
Trilateral Research logo

Trilateral Research review

Software product

Trilateral GRC Suite is software you run to keep UK GDPR records, DPIAs and EU AI Act work in one place, marketed to regulators and public bodies.

Relevant if you buy through Crown Commercial Service and want data protection and AI governance together

Price Not published
Indemnity cover Not published
How it uses AI Published
Facts last checked

Not published means we did not find it on the firm's own pages.

Trilateral Research scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 4/5
Qualifications of the people who do the work 3/5
What it publishes about fees 1/5
Knowledge of your sector 3/5
Independence from what it sells 2/5
Who carries the risk if the advice is wrong 1/5

What Trilateral Research offers, and what it publishes

This is software you run, not advice. It keeps records of processing, DPIAs, breach logs, a risk register and AI governance work together, mapped to the EU AI Act, ISO/IEC 42001 and the US NIST AI RMF. The product page describes an audit trail on incidents and bulk export for regulator requests. Trilateral also sells separate advisory services.

Trilateral Research does not publish a price. It says the software is sold on a fixed annual licence agreed after a discovery call, with no figures shown. It publishes no liability cap or uptime commitment, and no named client case studies for the software.

For its own security it shows Cyber Essentials Plus, but no SOC 2 report or ISO 27001 certificate. It is a Crown Commercial Service supplier, which can make buying simpler for UK public bodies. It says the suite is used by '30+ European regulators and institutions', but it names none of them.

Strengths

  • Single platform covers data protection (GDPR/UK GDPR) and AI governance (EU AI Act, ISO 42001, NIST AI RMF) together rather than as separate tools
  • Product page describes a continuous audit trail on incidents plus bulk CSV/DOC evidence export for regulator requests
  • Crown Commercial Service supplier status simplifies procurement for UK public-sector buyers

Things to check

  • No published price list means buyers cannot compare cost without booking a sales call.
  • No independently audited security certification such as SOC 2 or ISO 27001 is disclosed for the vendor itself, only the lighter-touch Cyber Essentials Plus scheme.
  • Named client case studies for the GRC Suite product itself are not published; the '30+ European regulators and institutions' figure is an aggregate claim, not broken out by name.

Common questions

Is Trilateral GRC Suite advice or software?

Software. It is a licensed product that your own team configures and runs. Trilateral also sells separate advisory services, but the suite itself is a software subscription.

Does Trilateral Research publish its prices?

No. It says the suite is sold on a fixed annual licence, but it shows no figures, tiers or ranges. You get a cost only after a discovery call.

What security certification does Trilateral hold for itself?

Cyber Essentials Plus. Its site also shows Crown Commercial Service supplier status and AWS Public Sector Partner status, but no SOC 2 report or ISO 27001 certificate for its own systems.

Evidence for each Trilateral Research score

Show our working

Notes behind each thing to check

  • No published price list means buyers cannot compare cost without booking a sales call. (trilateralresearch.com/trilateral-grc-suite states pricing is a fixed annual licence discussed on a discovery call, with no figures shown.)
  • No independently audited security certification such as SOC 2 or ISO 27001 is disclosed for the vendor itself, only the lighter-touch Cyber Essentials Plus scheme. (trilateralresearch.com homepage lists Cyber Essentials Plus and AWS Public Sector Partner status but shows no SOC 2 or ISO 27001 badge for Trilateral Research as a company.)
  • Named client case studies for the GRC Suite product itself are not published; the '30+ European regulators and institutions' figure is an aggregate claim, not broken out by name. (trilateralresearch.com/trilateral-grc-suite presents the client count without linked named case studies for the software product.)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 4/5 The product page describes a continuous structured record of governance activity with audit trails on incidents, and reports exportable in bulk CSV or individually as DOC for regulator requests.
Qualifications of the people who do the work 3/5 Names CEO Kush Wadhwa and discloses Cyber Essentials Plus certification, but no SOC 2 or ISO 27001 certification is shown for the vendor's own systems.
What it publishes about fees 1/5 No prices, ranges or tier names are published anywhere on the reviewed pages; licensing is fixed annual but the figure is undisclosed.
Knowledge of your sector 3/5 Markets to regulators and institutions generally and references public-sector and research-body work, but no named sector-specific product modules beyond the general GRC suite were found.
Independence from what it sells 2/5 Cyber Essentials Plus is an independently assessed scheme, but headline claims like being EU AI Act ready are self-declared marketing language with no named independent auditor.
Who carries the risk if the advice is wrong 1/5 No liability cap, indemnification clause or SLA/uptime commitment is published on any of the site pages reviewed.

Sources for Trilateral Research

  • Trilateral Research Ltd is registered with Companies House and shown as an active company. (Company no. 08698690; incorporated 20 September 2013; status: Active) (Companies House, checked 17 July 2026)
  • Trilateral GRC Suite's published scope covers records of processing activities, DPIAs, AI governance (EU AI Act, ISO/IEC 42001, NIST AI RMF), a risk register, policy management and incident/breach management. (Product scope confirmed on vendor site) (trilateralresearch.com, checked 17 July 2026)
  • Pricing is not published; the vendor describes a fixed annual licence agreed after a discovery call, with no figures or tiers shown on the site. (Pricing disclosure: gated / quote-based) (trilateralresearch.com, checked 17 July 2026)
  • Trilateral Research discloses Crown Commercial Service (CCS) supplier status and states its GRC Suite is used by '30+ European regulators and institutions', though no gov.uk AI Assurance directory listing was found for the company. (CCS supplier; no gov.uk AI Assurance listing found) (trilateralresearch.com, checked 17 July 2026)

Cyber Essentials Plus

Exposed to the EU AI ActSeeking ISO 42001 certificationRegulated sectors

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.